the post updating in on the server, so it bypasses the allow and deny on
the client side, so don't be shocked